b3a56112c76eba22c9eb53d70cc3479568b0a97793d0eda96f2d452016a9b29a

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_c7a62206826e02c39c56056f13f2b3f2_amadey_elex_smoke-loader.exe
Size 256KB
Sample260504-pevjcaax5y
SHA256 b3a56112c76eba22c9eb53d70cc3479568b0a97793d0eda96f2d452016a9b29a
MD5 c7a62206826e02c39c56056f13f2b3f2
SHA1 626abcdac31a340591d5d155cf6b18f7e9c42952
SHA512 522c6bf45995ce1933bbae21f5b59d33da08f1a82681f8970e5c23983eb92a43d136af2089f698788be24eaf0f086561a1f520df84f65ae0b77a9ce944885400
SSDEEP 3072:xlXG5Q1UCSkfSKzvo2qg+B0ocdaRxXlSUEyyOAg0FuDapgS54HZgIVMU:xIyUClfSGQgK7RTtAOWpgA4HLaU
TLSH
T144446B21B5C2D4B2D1BA16344C78E79D463DBD200FA19E7B63D43B2E1E741C1D632EAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	1072	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_c7a62206826e02c39c56056f13f2b3f2_amadey_elex_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-04_c7a62206826e02c39c56056f13f2b3f2_amadey_elex_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_c7a62206826e02c39c56056f13f2b3f2_amadey_elex_smoke-loader.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 248
  2⤵
  - Program crash
  PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1072 -ip 1072
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads